# This function updates employee information.
def update_employee_info(employee_id, new_info, user_role):
    if user_role == "admin":  # Incorrectly assuming user_role is trusted
        # Update employee info in the database
        ...
        return "Information updated successfully"
    else:
        return "Access denied. No permission to perform this operation."

# API endpoint to update employee information
@app.route('/employees/<employee_id>', methods=['PUT'])
def update_employee(employee_id):
    new_info = request.json
    user_role = get_user_role(request.headers['Authorization'])  # Function to get user role
    return update_employee_info(employee_id, new_info, user_role)

